Dumping an NEC D23C4000 Chip

Sega Channel Japan BIOS / Dumping an NEC D23C4000

Hmmmm, anyone got any pointers for what I should be doing? I've got a GQ-4X and a 16-bit adapter (40 and 42-pin).
Now there's no chip in the database called D23C4000 so I've picked a D27C4000 and there is human readable code in there.
But a good chunk of the machine code decides to change each time it is dumped.

I've tried all the basics of cleaning the legs and sockets, with no change (or rather continuous change with each dump...)
I haven't been able to find much on the D23C4000 in DIP40 though, I did see a 32 or 36-pin type in a datasheet or two.

Any ideas?

Edit 1: This is to help dump the Sega Channel (Japan) BIOS.
Edit 2: Perhaps some eye candy to pass the time.
- Photos of unit 1 [Serial: BB40002456]
- Photos of unit 2 [Serial: BB40010501]
Edit 3: Dumped successfully, both advise 2.11 - yet have different contents. The actual Mask ROMs themselves are around 11 weeks apart.
From unit with the serial BB40002456 - clicky
From unit with the serial BB40010501 - clicky
And of course credit where credit is due. None of this would have been possible at all without Doc Eggfan (of Sonic Retro) sending over the carts for me to dump in the first place. Thanks!

 

I presume we're talking about the μPD23C4000, a NEC x8/x16 mask ROM with a JEDEC "27C400" pinout. A programmer really shouldn't even have it in its database since it's just a generic ROM. The problem could be that "D27C4000" is a derived algorithm from the NEC 23/27C1000, which confusingly is a 27C100/010 ie 32-pin 1M x 8. So my suggestion is to find a 27C400 and use that.

 

Thanks for the assistance, I've given it a go with 27C400 but the case seems to remain the same.
Any ideas on why the dumps wouldn't be identical?

For a frame of reference the chips have been desoldered off a Japanese Sega Channel cartridge.
Any of the dumps seem to load OK into most emulators (not KEGA though...) and show the attached screen.
I can only assume it is saying that to check the hardware like the US counterpart does when plonked into an emulator.

 

Ah yes, just saw the chatbox message now. Would the word / byte pin (pin 31) be one or the other by default?
I tried grounding it and I only get half the human readable text as below;
The top half is consistent and doesn't ever seem to change. Should I try feeding in 5V to pin 31?

 

VCC is reading as ~4.45V idle, kicks up to 5.1V when reading the chip.
Thanks for the 27C4000 datasheet, "pinout compatibility with 40-pin mask ROM uPD23C4000" - excellent!
I still have no idea why the code is changing each time it is dumped.

Just tried another chip (27C1024) in the adjacent socket and the checksum showed the same for five reads in a row.
I think one of my Sophias had a HN27C4096G-12 in them, I'll see if I can get that to read a few times in a row with the same code.

Edit: Arrgghhh! Sophia had HN27C4096G-10 chips. The HN27C4096G-12 seem to need a different adapter again anyway...

 

I've been given the OK to share the dumped images by the owner of the Sega Channel carts - Here is the link to the dumps so far
The files are named by the serial number of the unit, although the version of the BIOS appears to be the same 2.11J.
If anyone has any ideas on what I could be doing wrong when dumping these or any theories on why the data is changing, it would be most appreciated as always

Edit: Hmm, is there anyway to change the title? I tried, but it hasn't updated it outside of this post.
Photos are uploaded here now. Enjoy!

 

x

 

"Checksum error"

Receiver card is abnormal
If this error recurs, please contact your cable TV service

Looks like a bad dump.

 

Haha, well it should be a bad dump given every time I dump the chip it keeps giving a different checksum
That is interesting though that it is checksumming... any ideas on why the each dump would be different though?

 

Save a bunch of the dumps and see if you can find an address or data pattern. The chip could be physically damaged, the read algorithm could be bad such as the wrong pinout, some pins might not being driven, the hardware could have threshold issues, the ROM might not support /byte...

 

This appears to be the correct datasheet for the EPROM device:

http://www.datasheetarchive.com/dlmain/Datasheets-22/DSA-430854.pdf

And this file here:

http://www.ecadata.de/html/nec/58/txtidx.htm

Says this:

4M 512K ∞ 8 µPD27C4000 150 50 • 40-pin DIP (600 mil) Pin-compatible with Mask ROM or 256K 170 µPD23C4000 series ∞ 16 200 (selectable)
So it looks like that mask ROM should have the same pinout.

It might be worth checking to see if the programmer is attempting to use the old "high voltage on A9" identify protocol, since that can induce latchup in some mask ROMS that don't have a high-voltage tolerant A9 input.

Edit:

And the message in that other photo is basically just "trying to connect". (setsuzoku shori chu).

 

So many things, so little time. Here's the dumps done so far. If anyone wants to help I'd be more than grateful If not, I understand - it is a bit of a needle in a haystack.

How high is high? 1.8V-3.9V?

 

A9 issue I had reading some maskroms too (my programmer has current protection. Which would trip and stop you reading the maskrom as a 27C) - company who makes my programmer added support for the 23c MX chips for me.

This chip is the same as the MX MX23C4100 - which my programmer supports and doesnt use A9 for ID.

Like I offered - I will be happy to dump it for you, no fee - just cover return shipping.

 

JEDEC standard is 12.5V - which is more than enough to induce latchup in most CMOS chips running from a 5V rail.

 

You are a gentleman and a scholar. For science? For science!
I'll check it's alright with the owner of the devices and I'll shoot you a PM! Thanks!

Ahhh, thanks for the help, I did find there is a "chip compatibility jumper" (J5) - And it recommends to only change it if the chip has inconsistent reading, writing. Too bad it didn't help this time

 

x

 

Onto both of them now, that Guru fellow seems to have the right idea though after reading through his FAQ!

Edit: I'll try the Sega CD transfer method too. Wiring is going to be crude since I have no parallel port plugs

 

Great news, I'm getting a consistent read now using a VCC of 3.6V instead of the default 5V.
However the two chips are reading with different checksums (at least their checksums aren't floating about all over the place now...)
Apparently this is correct as they are actually different internally, checksums match up internally.

From unit with the serial BB40002456 - clicky
From unit with the serial BB40010501 - clicky

Thanks go out to;
- Dr Eggfan of Sonic Retro for supplying the cartridges. Hard to get anywhere without these!
- ZLM of MCUmall for knowledge on changing voltages on the GQ-4X.
- Guru (of MAME fame) for the idea of changing the voltage ±0.1V... or in my case 1.4V since the GQ-4X isn't that fine tuned
- Meat Miracle of Sonic Retro for confirming the checksums are good.
- Bad_Ad84 for offering to dump the ROMs free of charge!

And of course everyone in this thread for prodding my along in my quest for knowledge. Ripper Rita!
What a community we all are

Edit: I've added some additional photos to the galleries in the first post as well as updated the links. Enjoy!